securing your web apps now
Post on 09-Jun-2015
305 Views
Preview:
DESCRIPTION
TRANSCRIPT
SECURING YOUR WEB APPS NOWTIPS TO MAKE YOUR SITE LESS HACKABLE
WHO?• Stephan Steynfaardt
• Solutions Architect & Tech Lead
• CISSP certified
• White hat penetration testing
• @ssteynfaardt
WHAT?• Validation
• SQL injection
• OS injection
• Code injection
• File upload
• Information leakage
• Broken Authentication & Session Management
• XSS
WHY?
IT NEEDS TO BE EASY ENOUGH FOR ANYBODY, EVEN MY MOTHER
IT’S NOT JUST OUR MOTHERS VISITING WEBSITES.
I don’t even trust the panda
ANY 4 YEAR OLD WITH AN INTERNET CONNECTION
Nothing to do with SSL
WEB APPLICATIONS TESTED BY OWASP
WORLD’S BIGGEST DATA BREACHES
2013
HOW?• More than one security layer
HOW?• More than one security layer• Validate• Escape• Bind SQL• Least privileges• Generic error exceptions
messages• Don't display error messages
VALIDATION
VALIDATION• Client side validation is useless
• Whitelisting acceptance criteria
• Typecast your variables
• Never trust any data
• Respect\Validation
Top 10 OWASP list
SQL INJECTION
SQL INJECTION• Don't use quotes – You only need to
miss one
• Always bind your parameter
BIND PARAMETER
$sql = "SELECT * FROM users WHERE name=:name and age=:age";
$stmt = $db->prepare($sql);
$stmt->execute(array(":name" => $name, ":age" => $age));
SQL INJECTION• Don't use quotes – You only need to
miss one
• Always bind your parameter
• Only allow SQL privileges required
• SQL MAP
Cracking password hashes
SQL MAP
CODE INJECTION
CODE INJECTION• Eval() === Evil
$var = 1;
$newvalue = isset($_GET['id']) ? $_GET['id'] : 0;
eval('$var = ' . $newvalue . ';');
echo $var;
• PHP manual warns you against using eval()
CODE INJECTION• Don’t use preg_replace() with /e
• PHP 5.5 deprecated /e
• Dynamic function injection, don’t call it from the URL
• local.php?file=some_file.log
OS INJECTION
OS INJECTION• Statements executed directly on the OS
• Don’t use system()
• system('nslookup ' . $_POST['host']);
• 'google.com; rm -RF /var/www’
• Download any script with wget
• Validate file_get_contents()
bring your own exploit
FILE UPLOADS
Actually any PHP n00bs
WORDPRESS N00BS
FILE UPLOADS• Upload files outside of the webroot
• Check the mime-type
• file -i logo.pnglogo.png: image/png; charset=binary
• file –i evil_file.png evil_file.png: text/plain; charset=us-ascii
• Rename file
• Move to desired location
INFORMATION LEAKAGE
INFORMATION LEAKAGE• Phpinfo()
• php.ini dispay_error = Off
• php.ini dispay_startup_error = Off
• php.ini error_reporting = E_ALL & ~E_DEPRICATED
• php.ini html_errors = Off
• php.ini log_error = On Always log your errors to a file
OVER SPECIFIC FEEDBACK
OVER SPECIFIC FEEDBACK• Login forms messages
• Forgotten debug statements
• Server headers
• php.ini, expose_php = Off
• httpd.conf, Server Tokens Full | OS | Minor |Major | prod
• modSecurity
SENSITIVE DATA EXPOSURE
All your data are belong to us- NSA
SENSITIVE DATA EXPOSURE• OWASP, top 10 2013, simply not encrypting data
• Only store the data you need
• MD5, SHA1 is not for passwords
• Passwords are easy to guess
• Bcrypt is for passwordsircmaxwell/password-compat zendframework/zend-crypt
• PHP 5.5password_hash()
• cost, more rounds = better security but more time/performance penalty
SENSITIVE DATA EXPOSURE• Directories should be 750 or 755
• Files should be 644 or 640
• Locate directories that are 777 on your server:$ sudo find /var/www/ -type d -perm -002
• Locate files that are 777 on your server:$ sudo find /var/www/ -type f -perm -002
• User should own the web directory
• Group should be the apache user
BROKEN AUTHENTICATION & SESSION MANAGEMENT
BROKEN AUTHENTICATION & SESSION MANAGEMENT
• #2 on OWASP top 10 2013
• Allows attackers to impersonate other user currently logged in.
• Don’t display the sessionID in the URL
• Hidden fields – isAdmin
• Remove the session cookie when done
• Regenerate sessionID's after login
BROKEN AUTHENTICATION & SESSION MANAGEMENT
• session_destoy()session_unet()
• Remember me functions
• chrome://settings/passwords
Cross Site Scripting
XSS
XSS• 65% of websites are venerable to XSS
• 2 types of XXSstoredreflected
• Steal sessionID from cookies
• Escape all form input – htmlspecialhars()
• ezyang/htmlpurifier, escape_html
• cookies HTML Only
• document.write hidden iframe
GOING FORWARD
GOING FORWARD• 57% organizations provided some software security
training
• 40% fewer vulnerabilities
• Resolved issues 59% faster
• owasp.org
• https://security.sensiolabs.org/
GOING FORWARD• 19 Extensions to Turn Google Chrome into Penetration
Testing toolhttp://resources.infosecinstitute.com/19-extensions-to-turn-google-chrome-into-penetration-testing-tool/
• PHP security manualhttp://php.net/manual/en/security.php
• Code reviews
• Try it yourself
top related